{"id":"CVE-2026-106022","kind":"vulnerability","aliases":["CVE-2026-106022"],"related":[],"title":"Johnson Controls EasyIO Neo IOManager: cleartext secrets in memory leak sensitive data","description":"Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data.\n\nThis issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.","summary":"EasyIO Neo IOManager and Tools Installer 1.1.0.0 keep sensitive authentication or authorization data in cleartext in process memory. A local user on the machine can extract it. CVSS 4.0 8.6 (vector AV:L, PR:L, UI:P). No exploitation reported.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EasyIO Neo IOManager and Tools Installer","fixed":["IO Manager 2.0","Tools-Installer 2.0.0.0"],"affected":"1.1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["building-automation","easyio","infrastructure","johnson-controls","local-access","windows-workstation"],"not_affected_if":[],"how_to_check":"Check the installed EasyIO Neo IO Manager and Tools Installer version: 1.1.0.0 is affected. Also check commissioning workstations where it is installed and who has local accounts there.","fix":"Upgrade to EasyIO Neo IO Manager 2.0 and Tools-Installer 2.0.0.0 (per secondary summary of the vendor advisory; not confirmed on the vendor page)","status":"open","published_at":"2026-11-06T15:17:05+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:06+00:00","updated_at":"2026-11-06T15:45:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T15:44:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Johnson Controls EasyIO Neo IOManager: cleartext secrets in memory leak sensitive data","impact":"medium","summary":"Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0 stores sensitive information in cleartext in memory. An attacker who can read that memory or the installed files can retrieve embedded sensitive data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["easyio","johnson-controls","building-automation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive embedded data retrieved from memory or installed files","analyst_note":"Confirm the fixed version and attack prerequisites from the Johnson Controls advisory; NVD lists only the affected version 1.1.0.0 and CVSS 8.6.","how_to_check":"- Check the installed IOManager and Tools Installer version against `1.1.0.0`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running EasyIO Neo IOManager and Tools Installer version 1.1.0.0 are affected, per NVD. The sources do not say what access an attacker needs or which configuration is exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":4232,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and attack prerequisites from the Johnson Controls advisory; NVD lists only the affected version 1.1.0.0 and CVSS 8.6.","search":"'-106022':15A,18A '-2026':14A,17A '1.1.0.0':45B,110C '4.0':67B '8.6':68B 'access':35B 'affect':103C 'allow':96C 'and':22A 'authent':48B 'author':50B 'autom':27B 'av':70B 'build':26B 'building-autom':25B 'cleartext':6A,53B,79C 'control':2A,32B,89C 'cve':13A,16A 'cvss':66B 'data':12A,51B,100C 'easyio':3A,19A,28B,39B,90C,104C 'embed':98C 'exploit':77B 'extract':64B 'inform':83C 'infrastructur':29B 'instal':44B,95C,109C 'installer':24A 'iomanag':5A,41B,92C,106C 'iomanager':21A 'issu':102C 'johnson':1A,31B,88C 'johnson-control':30B 'keep':46B 'l':71B,73B 'leak':10A 'local':34B,58B 'local-access':33B 'machin':62B 'memori':9A,56B,85C 'neo':4A,20A,40B,91C,105C 'p':75B 'pr':72B 'process':55B 'report':78B 'retriev':97C 'secret':7A 'sensit':11A,47B,82C,99C 'storag':80C 'tool':43B,94C,108C 'tools':23A 'ui':74B 'user':59B 'vector':69B 'vulner':86C 'window':37B 'windows-workst':36B 'workstat':38B","nicknames":[],"mitigations":[],"who_affected":"Engineering or commissioning workstations running EasyIO Neo IO Manager / Tools Installer 1.1.0.0. The attacker needs local access and low privileges on that machine (CVSS vector AV:L/PR:L/UI:P) to read secrets from process memory. Teams that do not use IO Manager, or already run 2.0, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["easyioneoiomanagerandtoolsinstaller","neoiomanagerandtoolsinstaller"],"ptokens":["and","easyio","installer","iomanager","neo","tools"],"labels":["buildingautomation","easyio","high","infrastructure","johnsoncontrols","localaccess","windowsworkstation"],"campaign_type":null,"search_a":"'-106022':15A,18A '-2026':14A,17A 'and':22A 'cleartext':6A 'control':2A 'cve':13A,16A 'data':12A 'easyio':3A,19A 'installer':24A 'iomanag':5A 'iomanager':21A 'johnson':1A 'leak':10A 'memori':9A 'neo':4A,20A 'secret':7A 'sensit':11A 'tools':23A","search_b":"'1.1.0.0':45B '4.0':67B '8.6':68B 'access':35B 'authent':48B 'author':50B 'autom':27B 'av':70B 'build':26B 'building-autom':25B 'cleartext':53B 'control':32B 'cvss':66B 'data':51B 'easyio':28B,39B 'exploit':77B 'extract':64B 'infrastructur':29B 'instal':44B 'iomanag':41B 'johnson':31B 'johnson-control':30B 'keep':46B 'l':71B,73B 'local':34B,58B 'local-access':33B 'machin':62B 'memori':56B 'neo':40B 'p':75B 'pr':72B 'process':55B 'report':78B 'sensit':47B 'tool':43B 'ui':74B 'user':59B 'vector':69B 'window':37B 'windows-workst':36B 'workstat':38B","search_c":"'1.1.0.0':110C 'affect':103C 'allow':96C 'cleartext':79C 'control':89C 'data':100C 'easyio':90C,104C 'embed':98C 'inform':83C 'instal':95C,109C 'iomanag':92C,106C 'issu':102C 'johnson':88C 'memori':85C 'neo':91C,105C 'retriev':97C 'sensit':82C,99C 'storag':80C 'tool':94C,108C 'vulner':86C","first_public_at":"2026-11-06T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106022","severity":null,"published_at":"2026-11-06T15:17:05+00:00","modified_at":"2026-11-06T15:17:05+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106022:1905","url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","severity":null,"published_at":"2026-11-06T15:45:23+00:00","modified_at":"2026-11-06T15:45:23+00:00","first_seen_at":"2026-11-06T15:45:23+00:00","fetched_at":"2026-11-06T15:45:23+00:00","note":"Vendor listing (JCI-PSA-2026-15, Nov 3 2026) confirms advisory covers this CVE but I could not open the advisory PDF itself; fix IO Manager 2.0 / Tools-Installer-2.0.0.0 and local-access prerequisite come from Viakoo summary only, so nothing marked verified.","cites":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/"]}],"documents":[{"id":54501,"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","title":"Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":87608,"url":"https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/","title":"Daily OT Security News: November 05, 2026 (Viakoo)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}